GitHub Advisoryadvisory · npm

GHSA-3pwh-5mmc-mwrx Denial of Service in nes

HIGH Published 2018-07-24 Modified 2020-08-31 Official page ↗
Aliases
CVE-2017-16025
Ecosystem
npm
Packages
nes
Severity
High
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm nes: < 6.4.1 → fixed in 6.4.1

Description

Affected versions of `nes` are vulnerable to denial of service when given an invalid `cookie` header, and websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit. Recommendation Update to version 6.4.1 or later.

Related

Alias · CVE (1)

  • CVE-2017-16025 Nes is a websocket extension library for hapi. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References